InfoSecBulletin Cybersecurity for mankind
TP-Link has revealed several serious security flaws in Aginet networking products managed by ISPs. This includes mesh systems, routers, PON devices, and xDSL modems.
The flaws might let attackers who can connect to the network get around checks, gain higher access, steal important data, look at device files, and run system commands.
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
CrowdStrike’s ‘FalconFlank’ zero-day allows SYSTEM privileges
727,000 data exposes: French hospital fined €500,000
153 Million Driver’s License Surfaced on Dark Web: FBI Starts Investigation
Google Unveils Gemini 3.8 Flash Cyber to Identify and Auto-Patch Security Flaws
SonicWall SMA1000 SSRF Hits 10, Exploiting CVE-2026-83548Â
Gartner
70% of SOCs Will Pilot AI Agents: Only 15% Will See Results
CVE-2026-62911
Nearly 22,000 Microsoft Exchange Servers are vulnerable to attack
The security notice, updated on August 10, 2026, lists problems as CVE-2025-30237 to CVE-2025-30241. Internet service providers usually supply, set up, and update the affected products, so firmware may change depending on the provider and area.
The main flaw, CVE-2025-30237, is a way to get around logging in on the web management page. It has a CVSS v4 score of 8.7 and happens because of failed access rules on some links.
An attacker on a nearby network can send special requests to access important functions without login details. If this happens, the attacker could take complete control of the device.
| CVE | Vulnerability | Severity |
|---|---|---|
| CVE-2025-30237 | Authentication bypass | High |
| CVE-2025-30238 | Privilege escalation | High |
| CVE-2025-30239 | Sensitive data exposure | High |
| CVE-2025-30240 | Arbitrary file read | Medium |
| CVE-2025-30241 | OS command injection | High |
Multiple TP-Link Flaws
CVE-2025-30238, rated 8.6, is a mistake in user-management that lets low-level users do admin tasks. This means they might create special accounts or change important settings. An attacker with little access could gain more control over a router or mesh node.
Another high-severity issue, CVE-2025-30239, involves hardcoded cryptographic keys stored in firmware. The vulnerability has a CVSS score of 8.5.
An attacker with access to the device’s storage could recover the embedded keys and decrypt protected configuration data. Exposed information may include credentials and ISP-related service settings, creating a risk of further compromise.
CVE-2025-30240 is a medium-severity arbitrary file-read issue with a CVSS score of 5.1. The flaw affects the USB HTTPS access path and stems from improper handling of symbolic links on external USB storage.
A person who can physically reach the device might make a harmful symbolic link on a supported device and use it to get to important files in the router’s system.
The last flaw, CVE-2025-30241, is a serious flaw that lets attackers run commands on the OS. It has a high danger level of 8.6. This happens because some web parts do not check user input correctly before sending it to system commands.
An attacker on the local network could send commands and run them with higher access, possibly gaining full control of the device. The affected devices are from TP-Link’s HB, HX, HC, EB, EC, EX, XC, XX, and VX series.
HB810, HB710, EX220, EX222, EX920, EC220-G5, XX530v, and VX1800v are some examples. The effect varies based on the model for the area, hardware type, ISP changes, and the firmware installed.
TP-Link said that fixing ISP-managed devices will be done with the help of service providers. Often, updates can be installed automatically using ISP management tools.
Users need to look at the router’s admin page or the provider’s app for firmware updates. If there is no update, customers should reach out to their ISP to see if their device is impacted and when a fix will be available.
Users should limit access to management tools because some problems need local or nearby network access. They should use strong, different passwords for administrators, disable unneeded remote management options, and keep untrusted users away from the local network.
